| *** bdpayne has quit IRC | 00:02 | |
| *** salv-orlando has quit IRC | 00:10 | |
| *** dave-mccowan has joined #openstack-security | 00:13 | |
| *** bpokorny has quit IRC | 00:14 | |
| *** JAHoagie has quit IRC | 00:14 | |
| *** browne has joined #openstack-security | 00:33 | |
| *** tmcpeak has quit IRC | 01:45 | |
| *** salv-orlando has joined #openstack-security | 01:59 | |
| *** mgagne has quit IRC | 02:02 | |
| *** salv-orlando has quit IRC | 02:04 | |
| *** mgagne has joined #openstack-security | 02:08 | |
| *** mgagne is now known as Guest39926 | 02:08 | |
| *** browne1 has joined #openstack-security | 02:34 | |
| *** browne has quit IRC | 02:37 | |
| *** gotajob has joined #openstack-security | 02:44 | |
| *** bpokorny has joined #openstack-security | 02:44 | |
| gotajob | hi | 02:45 |
|---|---|---|
| gotajob | bye | 02:46 |
| *** gotajob has left #openstack-security | 02:46 | |
| *** salv-orlando has joined #openstack-security | 03:28 | |
| *** tkelsey has joined #openstack-security | 03:49 | |
| *** tkelsey has quit IRC | 03:55 | |
| *** bpokorny has quit IRC | 04:00 | |
| *** salv-orlando has quit IRC | 04:08 | |
| *** aswadr has joined #openstack-security | 04:21 | |
| *** dave-mccowan has quit IRC | 05:02 | |
| *** salv-orlando has joined #openstack-security | 05:11 | |
| *** salv-orlando has quit IRC | 05:49 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/security-doc: Imported Translations from Transifex https://review.openstack.org/171472 | 06:16 |
| *** tkelsey has joined #openstack-security | 06:42 | |
| *** tkelsey has quit IRC | 06:46 | |
| *** salv-orlando has joined #openstack-security | 07:14 | |
| *** salv-orl_ has joined #openstack-security | 07:50 | |
| *** salv-orlando has quit IRC | 07:55 | |
| *** browne1 has quit IRC | 08:02 | |
| *** browne has joined #openstack-security | 08:15 | |
| *** browne has quit IRC | 08:29 | |
| *** salv-orl_ has quit IRC | 08:47 | |
| *** hure_s has joined #openstack-security | 09:28 | |
| *** hure_s has quit IRC | 09:28 | |
| *** salv-orlando has joined #openstack-security | 10:08 | |
| *** sr_slack has joined #openstack-security | 10:10 | |
| *** sr_slack is now known as teh_slack | 10:30 | |
| *** tmcpeak has joined #openstack-security | 11:02 | |
| *** hbashk1 has joined #openstack-security | 11:05 | |
| *** hbashk1 has quit IRC | 11:12 | |
| *** bknudson1 has quit IRC | 12:16 | |
| *** browne has joined #openstack-security | 12:32 | |
| *** dave-mccowan has joined #openstack-security | 12:47 | |
| *** bknudson has joined #openstack-security | 13:00 | |
| *** asrangne has joined #openstack-security | 13:09 | |
| *** aswadr has quit IRC | 13:12 | |
| *** edmondsw has joined #openstack-security | 13:12 | |
| *** nkinder has quit IRC | 13:12 | |
| *** singlethink has joined #openstack-security | 13:25 | |
| *** browne has quit IRC | 13:37 | |
| *** browne has joined #openstack-security | 13:41 | |
| *** nkinder has joined #openstack-security | 14:02 | |
| *** browne has quit IRC | 14:04 | |
| *** JAHoagie has joined #openstack-security | 14:04 | |
| *** ndillon has joined #openstack-security | 14:09 | |
| *** salv-orlando has quit IRC | 14:12 | |
| *** JAHoagie has quit IRC | 14:15 | |
| *** asrangne__ has joined #openstack-security | 14:20 | |
| *** ndillon is now known as sicarie | 14:21 | |
| *** asrangne has quit IRC | 14:22 | |
| *** voodookid has joined #openstack-security | 14:23 | |
| *** tmcpeak has quit IRC | 14:30 | |
| *** browne has joined #openstack-security | 14:34 | |
| *** tmcpeak has joined #openstack-security | 14:43 | |
| *** dwyde has joined #openstack-security | 14:44 | |
| *** dwyde has quit IRC | 14:57 | |
| *** dwyde has joined #openstack-security | 14:59 | |
| *** JAHoagie has joined #openstack-security | 15:11 | |
| *** salv-orlando has joined #openstack-security | 15:12 | |
| *** bpokorny has joined #openstack-security | 15:15 | |
| *** singlethink has quit IRC | 15:56 | |
| *** dave-mccowan has quit IRC | 16:09 | |
| *** dave-mccowan has joined #openstack-security | 16:13 | |
| *** dwyde has quit IRC | 16:17 | |
| *** singlethink has joined #openstack-security | 16:22 | |
| *** singlethink has quit IRC | 16:26 | |
| *** asrangne__ has quit IRC | 16:28 | |
| *** singlethink has joined #openstack-security | 16:37 | |
| *** sicarie has left #openstack-security | 16:57 | |
| *** dwyde has joined #openstack-security | 16:58 | |
| *** sdake has joined #openstack-security | 17:05 | |
| sdake | hey quick question about adding bandit as a non-voting gate | 17:05 |
| sdake | looking at keystone I see they added a gate-tox-bandit gate | 17:06 |
| sdake | but I don't see any tox code to start bandit inside keystone | 17:06 |
| tmcpeak | bknudson: ^ | 17:14 |
| tmcpeak | sdake: check this: https://review.openstack.org/#/c/157930/6 | 17:15 |
| sdake | found it thanks :) | 17:15 |
| bknudson | sdake: here's how I set up the experimental job: https://review.openstack.org/#/c/157595/ | 17:20 |
| sdake | bknudson thanks for the link - i'll submit that next - want to get tox in first | 17:21 |
| sdake | prefer all our gating goes via tox | 17:21 |
| bknudson | y, you're going to need the tox env. | 17:21 |
| tmcpeak | sdake: which project are you working on? | 17:21 |
| tmcpeak | Barbican? | 17:21 |
| bknudson | probably should make sure it's called "bandit" so we're consistent | 17:21 |
| sdake | what is odd is a git pull of keystone doesn't show the first review even tho its +2/+A | 17:21 |
| bknudson | sdake: it hasn't merged yet. | 17:21 |
| sdake | tmcpeak - magnum | 17:21 |
| sdake | bknudson got it thanks | 17:21 |
| tmcpeak | ooh, cool | 17:21 |
| * tmcpeak looks | 17:21 | |
| sdake | heard about it this morning in a team meeting | 17:22 |
| tmcpeak | awesome! | 17:22 |
| sdake | the more linting the better ;) | 17:22 |
| bknudson | we need more team meetings | 17:22 |
| sdake | oh it was an internal thing | 17:22 |
| bknudson | do we have a security liaison for all the projects? | 17:22 |
| tmcpeak | the profile that Keystone is using is probably appropriate for your use also, but I can work with you to make any profile changes for your project or anything else to help | 17:22 |
| *** rlpple has joined #openstack-security | 17:22 | |
| sdake | i used keystone profile and it kicked out some errors about yaml.load | 17:23 |
| sdake | but those are busted, they need fixing anyway - so it actually found some real problems :) | 17:23 |
| bknudson | y, I don't know if we want a common profile for all openstack or a separate one for each project? | 17:23 |
| bknudson | I have to create bandit jobs for the other keystone projects (keystoneclient and keystonemiddleware) | 17:23 |
| tmcpeak | separate per project probably makes sense, although the one that Keystone is using is probably sensible for most | 17:24 |
| sdake | just so I'm cear, there are about 200 test cases in bandit correct? | 17:25 |
| sdake | (for the commit log) | 17:25 |
| tmcpeak | that sounds very high | 17:25 |
| sdake | ok I saw 0..25..50 etc thought those were the test cases | 17:26 |
| tmcpeak | I think there are about 30 plugins, the profile Keystone uses has probably half of those enabled. Some of those plugins look for a few things (like blacklist functions) | 17:26 |
| sdake | must have been files processed | 17:26 |
| tmcpeak | sdake: those are files processed | 17:26 |
| *** Guest39926 is now known as mgagne | 17:29 | |
| *** mgagne has joined #openstack-security | 17:29 | |
| tmcpeak | sdake: would you mind adding me on reviews for anything for your project? would like to follow along :) | 17:34 |
| tmcpeak | anything meaning any Bandit stuff | 17:34 |
| sdake | will do tmcpeak | 17:34 |
| tmcpeak | sdake: thanks! | 17:34 |
| sdake | your gerrit id is tmcpeak? | 17:35 |
| tmcpeak | sdake: travis-mcpeak | 17:36 |
| *** rlpple has quit IRC | 18:05 | |
| tmcpeak | bknudson: you around? | 18:22 |
| bknudson | tmcpeak: y | 18:22 |
| tmcpeak | I'm going to put up something on Bandit wiki to help other projects get started with a Bandit gate like you did with Keystone | 18:23 |
| tmcpeak | want to make sure I list all the right things :) | 18:23 |
| tmcpeak | so there is a change like sdake just did: https://review.openstack.org/#/c/171755/ | 18:23 |
| tmcpeak | this adds tox and the bandit config file | 18:23 |
| tmcpeak | are there any other changes to the project itself? | 18:24 |
| tmcpeak | I assume there is also a change in the projects gate config | 18:24 |
| bknudson | tmcpeak: https://review.openstack.org/#/c/170569/ is the infra change to have a non-voting gate job | 18:25 |
| tmcpeak | bknudson: cool, anything else? | 18:25 |
| bknudson | tmcpeak: no, that's all you need | 18:26 |
| bknudson | bandit.yaml, tox env, and infra gate job | 18:26 |
| bknudson | should cover it. | 18:26 |
| tmcpeak | bknudson: ok awesome, so will the line deps = bandit~=0.10.0 automatically download it in the virtualenv? | 18:26 |
| bknudson | we might want to change the tox env from using bandit~=0.10.0 to having a separate test-requirements-bandit.txt with the bandit req | 18:27 |
| bknudson | tmcpeak: yes, the deps causes tox to install bandit to the venv. | 18:27 |
| tmcpeak | if you have that though, checkins won't work because the Infra job which checks requirements will complain | 18:27 |
| tmcpeak | right? | 18:27 |
| tmcpeak | ie it will notice that your requirements don't match upstream | 18:27 |
| bknudson | I think the infra job only checks *requirements.txt | 18:28 |
| bknudson | not deps in tox.ini | 18:28 |
| bknudson | some might consider that a bug | 18:28 |
| tmcpeak | oh, I didn't read your message correctly: test-requirements-bandit.txt | 18:28 |
| bknudson | right, we can't have test-requirements-bandit.txt until bandit is in global-requirements | 18:29 |
| bknudson | that's why I used deps | 18:29 |
| bknudson | I'd prefer test-requirements-bandit.txt because then it'll be updated automatically when global-requirements changes. | 18:29 |
| tmcpeak | how does that work? | 18:30 |
| bknudson | there's a job that proposes updates to the requirements files when global-requirements changes. | 18:30 |
| tmcpeak | how will it find the test-requirements-bandit.txt file? | 18:30 |
| bknudson | I think it just looks for all *requirements*.txt files. | 18:31 |
| tmcpeak | also is there any precedent for having a test tool use it's own .txt file for requirements? | 18:31 |
| bknudson | not that I know of. | 18:31 |
| tmcpeak | I'd prefer Bandit inclusion to be as unobtrusive as possible, ie require less special files/stuff | 18:31 |
| tmcpeak | but you know this stuff a lot better than I | 18:32 |
| tmcpeak | so I'll defer to your judgement on best way to do it :) | 18:32 |
| bknudson | the crappy flake8 check just uses requirements.txt and test-requirements.txt because it needs all the packages installed. | 18:32 |
| bknudson | I think people will be happy that bandit doesn't require all the packages installed. | 18:32 |
| tmcpeak | oh yeah | 18:32 |
| tmcpeak | good point | 18:32 |
| tmcpeak | it does need YAML | 18:33 |
| bknudson | I assume bandit has yaml in its requirements.txt | 18:33 |
| tmcpeak | yeah, it does | 18:33 |
| bknudson | so all bandit reqs get installed along with bandit | 18:33 |
| tmcpeak | yep | 18:33 |
| tmcpeak | so where does this change you're talking about need to go? | 18:34 |
| *** nkinder has quit IRC | 18:34 | |
| bknudson | so I'd expect test-requirements-bandit.txt will just have bandit~=0.10.0 or whatever global-requirements has when that merges. | 18:34 |
| bknudson | the change is in the tox.ini for each project and also need to create the requirements.txt file in each project. | 18:34 |
| bknudson | deps = -r{toxinidir}/test-requirements-bandit.txt | 18:35 |
| tmcpeak | I've never seen that ~= before btw | 18:35 |
| tmcpeak | I've seen <= >= == | 18:35 |
| tmcpeak | ahh I see what you're saying | 18:35 |
| bknudson | I could propose that change in keystone and make it depends-on the global-requirements change to add bandit. | 18:36 |
| tmcpeak | cool stuff | 18:36 |
| tmcpeak | you think I should hold off on gate recommendations until we get this change done | 18:36 |
| tmcpeak | so i can point people to this | 18:37 |
| tmcpeak | it does seem like a better way | 18:37 |
| tmcpeak | or I guess I'll write up what we have | 18:37 |
| tmcpeak | and add this later | 18:37 |
| bknudson | I agree that it would be good to get it somewhat "finalized" in one project before pushing it out everywhere. | 18:37 |
| tmcpeak | yeah | 18:37 |
| tmcpeak | I think you've set a good example though, and now people are moving :) | 18:37 |
| bknudson | although maybe other projects are quicker to merge things than keystone... | 18:37 |
| tmcpeak | when you get this latest review in, I'll write up a blurb. Explain how to do Bandit config, and tox, and change infra to set up the gate | 18:39 |
| tmcpeak | then I'll add a piece at the end that says optionally projects may set up something like this: and point to your latest review | 18:39 |
| dave-mccowan | tmcpeak, bknudson i'm the barbican contributor who volunteered to work with bandit. i've been following this discussion closely. i'll be happy to beta test your instructions and start getting barbican ready today. | 18:40 |
| tmcpeak | dave-mccowan: awesome! | 18:41 |
| tmcpeak | I knew there was a Barbican guy somewhere | 18:42 |
| tmcpeak | :) | 18:42 |
| tmcpeak | dave-mccowan: I'll be really interested in feedback during the process too, and anything that's difficult | 18:43 |
| tmcpeak | although you're very familiar with Bandit | 18:43 |
| dave-mccowan | tmcpeak i'll let you know what i find. i need to step out for a bit, but will start working on this in a couple hours. | 18:47 |
| *** dave-mccowan has quit IRC | 18:47 | |
| tmcpeak | dave-mccowan: sounds great, thanks! | 18:47 |
| bknudson | tmcpeak: here's the change to create t-r-b.txt: https://review.openstack.org/#/c/171772/ | 18:48 |
| tmcpeak | bknudson: awesome | 18:48 |
| tmcpeak | do you want to pin a version though? | 18:49 |
| tmcpeak | bandit==0.10.0 | 18:49 |
| bknudson | tmcpeak: I copied the line from global-requirements.txt | 18:49 |
| bknudson | https://review.openstack.org/#/c/167126/1/global-requirements.txt | 18:49 |
| bknudson | it has to be the same. | 18:49 |
| tmcpeak | oh, i think infra guys wanted a pinned version | 18:49 |
| bknudson | so if g-r is wrong then that needs to be updated. | 18:49 |
| tmcpeak | they told me that before | 18:49 |
| tmcpeak | yeah, they told me they really want a pinned version on any linter | 18:50 |
| tmcpeak | so that we don't break things when we introduce new functionality | 18:50 |
| tmcpeak | I'd set to bandit==0.10.0 there too | 18:50 |
| tmcpeak | and again in your change | 18:50 |
| bknudson | tmcpeak: comment on the review | 18:50 |
| tmcpeak | bknudson: cool, will do | 18:52 |
| tmcpeak | bknudson: still around? | 19:28 |
| bknudson | tmcpeak: y, where would I go? | 19:28 |
| tmcpeak | lol, good question | 19:29 |
| tmcpeak | so Keystone is currently set up as a non-voting job, right? | 19:29 |
| tmcpeak | if a project wants to set up a voting one, how is that done? | 19:29 |
| bknudson | tmcpeak: keystone is currently set up only with an experimental job | 19:29 |
| bknudson | so you need to run `check experimental` to even see it | 19:30 |
| bknudson | the next step is to make it non-voting. | 19:30 |
| tmcpeak | bknduson: I thought this https://review.openstack.org/#/c/170569/2/zuul/layout.yaml made it non-voting | 19:30 |
| tmcpeak | oh, it's not merged | 19:30 |
| tmcpeak | I see | 19:30 |
| bknudson | tmcpeak: y, but that isn't merged. | 19:30 |
| tmcpeak | If a project wants to make it voting, what further change would they need? | 19:30 |
| tmcpeak | Here's new wiki section btw: https://wiki.openstack.org/wiki/Security/Projects/Bandit#Gate_Testing_with_Bandit | 19:32 |
| bknudson | tmcpeak: hmm.. this change shows how I set it up initially as a nonvoting: https://review.openstack.org/#/c/157595/ | 19:33 |
| bknudson | https://review.openstack.org/#/c/157595/5/zuul/layout.yaml | 19:33 |
| bknudson | so in order to make it voting, you just have voting: true, I guess. | 19:33 |
| tmcpeak | ahh ok I missed that step | 19:34 |
| bknudson | I think you can make a template for these jobs so it'll probably change in future when there's more projects doing it. | 19:34 |
| bknudson | y, I should have linked to that one... forgot that you're going to need to define the job for each project. | 19:34 |
| bknudson | at least until there's a template or whatever... I don't know how it all works. | 19:35 |
| *** singlethink has quit IRC | 19:38 | |
| tmcpeak | cool, I'll add that | 19:38 |
| *** singlethink has joined #openstack-security | 19:42 | |
| bknudson | tmcpeak: regarding https://wiki.openstack.org/wiki/Security/Projects/Bandit#Gate_Testing_with_Bandit | 19:46 |
| tmcpeak | yep | 19:46 |
| bknudson | step 2 says "Add a test-requirement-bandit.txt file. " -- this isn't temporary, the temporary thing is having deps =bandit in tox.ini | 19:46 |
| bknudson | t-r-b.txt is the permanent solution. | 19:47 |
| tmcpeak | bknudson: well once it is in global requirements, why won't it just be listed in requirements.txt | 19:47 |
| bknudson | tmcpeak: requirements.txt is for run-time requirements. | 19:47 |
| bknudson | you don't need bandit to run keystone. | 19:47 |
| tmcpeak | sorry, I mean test-requirements.txt | 19:47 |
| bknudson | test-requirements.txt contains a bunch of stuff that's not required to run bandit. | 19:48 |
| bknudson | I don't want to have to install all that just to run bandit | 19:48 |
| tmcpeak | right, but presumably that's the case for a lot of other tools too | 19:48 |
| bknudson | no, all the stuff in test-requirements.txt is required to run tox -e py27 | 19:48 |
| tmcpeak | ohhh | 19:48 |
| tmcpeak | I see what you're saying | 19:49 |
| tmcpeak | it's a tox environment that only has one requirement | 19:49 |
| bknudson | right | 19:49 |
| tmcpeak | gotcha | 19:49 |
| bknudson | one requirement for now... although hopefully it will stay that way | 19:49 |
| tmcpeak | so once it's in global requirements, what's going to change? | 19:49 |
| tmcpeak | (just so I get caught up to you) | 19:49 |
| bknudson | when global-requirements changes, the proposal bot will automatically propose an update to test-requirements-bandit.txt | 19:50 |
| tmcpeak | ok, with you so far | 19:50 |
| bknudson | if we don't care about that then we might as well leave it in tox.ini. | 19:50 |
| tmcpeak | no, that's good | 19:51 |
| tmcpeak | so if we set it up this way, it's automated | 19:51 |
| bknudson | I think we do want that, though... for bug fixes anyways. | 19:51 |
| tmcpeak | at least automated proposal | 19:51 |
| tmcpeak | yeah, seems like | 19:51 |
| tmcpeak | cool, I'll update wiki | 19:51 |
| tmcpeak | thanks for explaining | 19:51 |
| *** JAHoagie has quit IRC | 19:53 | |
| browne | tmcpeak: also #1 in your wiki has a URL that references a patch. Might be better to point to github location of that file since the patch merged | 19:54 |
| *** sdake_ has joined #openstack-security | 19:55 | |
| *** rlpple has joined #openstack-security | 19:57 | |
| *** rlpple has quit IRC | 19:57 | |
| tmcpeak | browne: good point | 19:57 |
| tmcpeak | thank you | 19:57 |
| browne | np | 19:57 |
| *** sdake has quit IRC | 19:58 | |
| *** JAHoagie has joined #openstack-security | 20:00 | |
| *** nkinder has joined #openstack-security | 20:09 | |
| *** dwyde has quit IRC | 20:12 | |
| *** dave-mccowan has joined #openstack-security | 20:14 | |
| *** sdake_ has quit IRC | 20:28 | |
| *** dwyde has joined #openstack-security | 20:32 | |
| *** JAHoagie has quit IRC | 20:36 | |
| *** dwyde has quit IRC | 21:13 | |
| *** gabriela has joined #openstack-security | 21:14 | |
| *** edmondsw has quit IRC | 21:15 | |
| *** JAHoagie has joined #openstack-security | 21:18 | |
| *** gabriela has left #openstack-security | 21:22 | |
| *** dwyde has joined #openstack-security | 21:36 | |
| *** bknudson has left #openstack-security | 21:58 | |
| *** dwyde has quit IRC | 22:09 | |
| *** jamielennox is now known as jamielennox|away | 22:11 | |
| *** salv-orlando has quit IRC | 22:47 | |
| *** salv-orlando has joined #openstack-security | 22:48 | |
| *** singlethink has quit IRC | 22:48 | |
| *** salv-orlando has quit IRC | 22:50 | |
| *** browne has quit IRC | 23:03 | |
| *** browne has joined #openstack-security | 23:04 | |
| *** voodookid has quit IRC | 23:07 | |
| *** jamielennox|away is now known as jamielennox | 23:12 | |
| *** sdake has joined #openstack-security | 23:40 | |
| *** sdake_ has joined #openstack-security | 23:42 | |
| *** sdake has quit IRC | 23:45 | |
| *** gabriela has joined #openstack-security | 23:48 | |
| gabriela | c | 23:49 |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!